Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.893.origin
Детект на основе машинного обучения.
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) 1####.196.223.26:7001
- TCP(HTTP/1.1) api.dianshi####.com:80
- TCP(HTTP/1.1) 1####.196.207.189:8080
- TCP(HTTP/1.1) c####.ka####.com.####.net:80
- TCP(HTTP/1.1) ip.3####.cn:80
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.0) g####.com:443
- TCP(TLS/1.0) lo####.co####.net:443
- TCP(TLS/1.0) and####.b####.qq.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) 1####.251.36.46:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 1####.217.168.238:443
- UDP www.google####.com:443
Запросы DNS:
- a####.u####.com
- and####.b####.qq.com
- api.dianshi####.com
- c####.ka####.com
- connect####.gst####.com
- g####.com
- ip.3####.cn
- lo####.co####.net
- m####.go####.com
- md####.google####.com
- open####.b####.com
- p####.google####.com
- tv####.chaosuz####.com
- u####.u####.com
- www.google####.com
Запросы HTTP GET:
- api.dianshi####.com/ipInfo
- c####.ka####.com.####.net/background/sdk/task_15003_1624437784766.jar
- g####.com:443/xu-tianyou555/diaoyong/raw/master/xinghuo
- ip.3####.cn/IPShare/info
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/date/hqg.png
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/date/limit.png
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/date/pay3.png
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/date/qun3.png
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/date/ssg.png
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/date/ugw.png
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/date/wxmg3.png
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/d0.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/d1.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/d2.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/d3.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/d4.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/gtch.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/gtth.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/lbch.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/lbmv.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/tvch.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/vod.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/kds/zbch.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/push/urlcfg.txt
- lo####.co####.net:443/p/appfiles/d/appfiles/git/raw/master/push/vodurl.txt
Запросы HTTP POST:
- al####.u####.com:443/unify_logs
- al####.u####.com:443/zcfg
- and####.b####.qq.com:443/rqd/asnc?aid=####
Другие:
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Запрашивает разрешение на отображение системных уведомлений.
